The new law, which passed the Senate and House unanimously, also bans employers from demanding that employees befriend them on social media in order to gain access to their respective profiles. Employers may also not demand access while in the employee’s presence, or in other words no shoulder-surfing.

There are a few exceptions. Employers may be granted access — but not be given the actual passwords — when “making a factual determination in the course of conducting an investigation.” The purpose of the internal “investigation” must relate to “work-related employee misconduct,” or instances when workers may be leaking confidential information. This law also does not apply to internal social networks.

“You will not share your password (or in the case of developers, your secret key), let anyone else access your account, or do anything else that might jeopardize the security of your account.”

Under section 5.7, it states that:

“If you collect information from users, you will: obtain their consent, make it clear you (and not Facebook) are the one collecting their information, and post a privacy policy explaining what information you collect and how you will use it.”